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WHAT IS CLAIMED IS : 

1. A method of analyzing of data streams in a communications 
network modeled by several layers, the method comprising the following 
steps: 

capturing a datastream; 
for a given network layer, analyzing the totality of the stream in order to 
detemnine the protocol or protocols present; 

producing different streams corresponding to at least one protocol 

present; and 

reiterating said analyzing step for a higher layer if any. 

2. The method according to claim 1, comprising the following steps: 

1) analyzing the captured packet: 

1 .a) if the packet is not recognized, passing to the next packet; 

1.b) if the packet is recognized, eliminating the packet from the 
captured stream, searching for an existing stream in order to insert the 
packet, and if there is no existing stream, generating a new stream, 

2) analyzing the streams generated at the step 1 ); 

3) releasing the resources. 

3. The method according to claim 1 comprising, further comprising: 
retrieving a list of the protocols liable to appear at the level considered; 
carrying out a frame-by-frame analysis of the stream in making a 

frame sequentially confront all the protocol signatures envisaged so long as 
the frame is not associated with a signature; 

retrieving the rule by packet of each frame recognized; 

classifying the frames as a function of the rules and positioning them 

in distinct streams; 

carrying out a total analysis of the distinct streams in using the 

recognized protocol or protocols; 

associating the stream rule coming from the analysis. 

4. The method according to claim 1, wherein the total analysis of the 
streams is made by means of tests of statistical or protocol analysis. 
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5. The use of the method according to claim 1, in the analysis of data 
in a network having the TCP/IP protocol. 

6. The device for the analysis of data streams in a communications 
network capable of being modeled in several layers, the device comprising at 
least one processor adapted to implement the method comprising the 
following steps: 

capturing a datastream, 

for a given network layer, analyzing the totality of the stream in order 
to determine the protocol or protocols present; 

producing different streams corresponding to at least one protocol 

present; 

reiterating the step of analysis for a higher layer if any. 

7. The device according to claim 6, wherein the processor is adapted 

to: 

1) analyze the captured packet; 

1.a) if the packet is not recognized, passing to the next packet; 

1.b) if the packet is recognized, eliminating the packet from the 
captured stream, searching for an existing stream in order to insert the 
packet, and If there is no existing stream, generating a new stream; 

2) analyzing the streams generated at the step 1)' 

3) releasing the resources. 

8. The device according to claim 6. wherein the processor is adapted 

to: 

retrieve the list of the protocols liable to appear at the level 
considered; 

carry out a frame-by-frame analysis of the stream in making a frame 
sequentially confront all the protocol signatures envisaged so long as the 
frame is not associated with a signature; 

retrieve the rule by packet of each frame recognized; 

classify the frames as a function of the rules and positioning them in 
distinct streams; 
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carry out a total analysis of the distinct streams in using the 
recognized protocol or protocols; 

associate the stream rule coming from the analysis. 

9. The device according to claim 6, wherein the total analysis of the 
streams is made by means of tests of statistical or protocol analysis. 

10. The method according to claim 2. wherein the total analysis of 
the streams Is made by means of tests of statistical or protocol analysis. 

11. The method according to claim 3, wherein the total analysis of 
the streams is made by means of tests of statistical or protocol analysis. 

12. A device for the analysis of data streams in communications 
network capable of being modeled in several layers, the device comprising at 
least one processor adapted in implementing the method comprising: 

capturing a means for capturing a datastream; 

analyzing means for analyzing for a given network layer, the totality of 
the stream in order to determine the protocol or protocols present; 

producing means for producing different streams corresponding to at 
least one protocol present; 

reiterating the step of analysis for a higher layer if any. 

13. The device according to claim 12, further comprising: 

1) analyze means for analyzing the capture packet; 

1 .a) if the packet is not recognized, passing means for passing 

to the next packet; 

l.b) if the packet is recognized, eliminating means for 
eliminating the packet from the captured stream, searching for an 
existing stream in order to insert the packet, and if there is no existing 
stream, g enerating a new stream; 

2) analyze means for analyzing the streams generated at the step 1); 

3) release means for releasing the resources. 
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14. The device according to claim 6, further comprising: 

retrieving means for retrieving the list of protocols liable to appear at 
the level considered; 

carrying means for carrying out a frame-by-frame analysis of the 
stream in mal<ing a frame sequentially confront all the protocol signatures 
envisaged so long as the frame is not associated with a signature; 

second retrieving means for retrieving the rule by packet of each 

frame recognized; 

classifying means for classifying the frames as a function of the rules 

and positionint them in distinct streams; 

second carrying means for carrying out a total analysis of the distinct 
streams in using the recognized protocol or protocols; 

associating means for associating the stream rule coming from the 

analysis. 

15. The device according to claim 14, wherein the total aniaysis of the 
streams is made by means of tests of statistical or protocol analysis. 



